Repository navigation
Veil — one bounded authenticated ingress route #57
Description
Outcome
One explicitly selected authenticated ingress route has an independently testable authority and transport boundary.
Next planning checkpoint: Later. This is the earliest scope/review conversation, not an assignment or a promise to finish the whole outcome in that week. Selected work starts at #52.
Remaining acceptance
- Define one typed Caddy/Veil Rune and route: host, path, method, protocol, exposure tier, body/time limits, backend identity and caller-authentication precondition.
- Compile and validate the full owned configuration before binding; reject overlaps, unknown backends and raw unrestricted directives. Admit only the selected service topology.
- Establish declared certificate and secret custody; test invalid/expired certificate refusal, failed activation and removal without opening an alternate route.
- Verify exact allowed traffic and denied routes, forged caller metadata and unauthorized requests against the admitted backend. Record the deployment and plaintext-custody limits.
Evidence and handoff
Start from current State of Work and its linked source/tests and owning ADRs. The linked original acceptance remains binding unless a named replacement outcome records its disposition. Detailed scope, negative cases and dated campaign evidence are preserved in preserved scope and evidence; historical evidence does not establish current qualification on its own. Any accepted requirement not selected for this profile needs an explicit route in #62 before this issue closes.
Choose one small implementation or verification slice when this outcome is admitted. Record the responsible contributor, exact profile/revision, observed result, failure/unknown boundary and next checkpoint. The founder reviews and approves all code for this campaign; merge and promotion follow CONTRIBUTING.
Activity
zenithruneblade commentedon Nov 6, 2026
Planning reset — 6 November 2026. The original acceptance below remains binding unless a named replacement outcome records its disposition. This is a preserved historical body, not a fresh capability/qualification claim.
Original issue scope and dated evidence before the planning reset
Prove one same-host Veil route in an isolated deployment with an exact backend and application authorization; do not expose the current loopback browser by adding a generic proxy.
Checklist
Open decision: choose one narrow backend operation, certificate source and local test topology under ADR 40; no general browser publication is included.
Contribution entry: typed route schema, compiler validation and negative fixtures can proceed before a live listener is enabled.
Completion: #18 lifecycle, #21 extension contribution and #24 application authority. #20 is needed only for a profile that selects Tether.
Later: separately isolated Gateway Home/Remote, certificate automation and broader ingress profiles; link ADR 40 rather than expanding this issue into all of them.
References: Proxy · Gateway · Security.
Shared contribution and touched-docs rules: #52.